Adobe has issued a critical update for the Flash Player product that fixes set of 11 critical security vulnerabilities in its software. The update is classified as critical because most of the security flaws could be exploited by a threat actor to remotely execute arbitrary code on a targeted machine.
Giving a look at the list of the vulnerabilities fixed by the update it is possible to note that nine flaws are Remote Code Execution vulnerabilities. In a classic attack scenario, the attack chain could start with specially crafted Flash file server through a phishing campaign. The specially crafted Flash file could be exploited by attackers to trigger the vulnerabilities and execute arbitrary code on the victim’s PC.
The complete list of all the patched vulnerabilities is reported below:
The vulnerabilities affect all versions prior to the latest version 220.127.116.11 of the Flash Player running on Windows and Mac OS X systems.
Adobe Flash Player installed with Google Chrome, as well as Internet Explorer on Windows 8.x, will automatically update to version 18.104.22.168
“Adobe has released security updates for Adobe Flash Player for Windows, Macintosh and Linux. These updates address vulnerabilities that could potentially allow an attacker to take control of the affected system.” states the Adobe Security Advisory Bulletin.
The security bulletin also reports that Adobe Flash Player 22.214.171.1242 for Linux and Flash Player Extended Support Release 126.96.36.1999 for Windows and Mac OS X are affected by the vulnerabilities fixed by the update.
The good news is that Adobe confirmed that none of the vulnerabilities are being publicly exploited in the wild, anyway security experts fear an escalation of attacks exploiting the above flaws after the release of the update. In the criminal ecosystem, it is quite easy to see a spike in the number of attacks targeting recently fixed vulnerabilities with the intent to exploit vulnerable machines not yet fixed.
Don’t waste time, if you are running Adobe Flash Player on your system update it!
(Security Affairs – Adobe, critical update)